No Add-on, No Second Button
Employees keep using the "Report phishing" option they already know from Gmail. There is nothing to install, pin or explain in a rollout email.
All integrations
Google Workspace integrationBeta
Google Workspace Phishing Simulation with Gmail's Built-In Report Button
AutoPhish records when employees report a simulated phishing email with Gmail's own "Report phishing" option. There is no add-on to deploy and nothing new to teach, and you finally see who reports a phish, not only who clicks.
This integration is in beta. It is included in every AutoPhish plan at no extra cost.
Click Rates Tell Only Half the Story
A team that never clicks is good. A team that reports the phish within minutes is what actually stops an attack. Measuring that in Google Workspace has been awkward: Gmail's report option cannot be pointed at a mailbox, so most phishing simulation tools ask you to roll out a separate add-on and retrain everyone to use a second button. AutoPhish takes the direct route. It reads the report alerts Google Workspace already creates and matches them to your simulations.
Connected in Three Steps
Authorize AutoPhish in Google Admin
Add the AutoPhish client ID under domain-wide delegation in the Google Admin console and grant a single scope for the Alert Center.
Name an Admin and Approve
Enter a Workspace admin on one of your verified domains. That admin receives an approval email, and AutoPhish reads nothing until they confirm.
Test and Launch
Run the built-in connection test, then send a simulation. Every report made in Gmail is recorded for the right campaign and recipient.
Built Around How Gmail Users Already Work
Reports Matched to the Simulation
AutoPhish matches each report to the exact simulation and recipient, so reporting shows up next to opens, clicks and training results.
See What Gets Reported in Real Life
Reports of emails that are not simulations are listed separately. You learn which real threats reach inboxes and who spots them.
Google Still Gets Every Report
Nothing is intercepted. Reports continue to reach Google, stay visible in your Alert Center and keep training Gmail's filters.
Read-Only Access Your Security Team Can Sign Off
The integration is built so that connecting it does not widen your attack surface.
- A single delegated scope for the Alert Center. AutoPhish has no access to mailboxes, Drive or the directory.
- AutoPhish only lists "User reported phishing" alerts. It never changes, deletes or acknowledges an alert.
- The named Workspace admin must approve the connection, and their domain must be verified for your company.
- A Google Workspace can be connected to one AutoPhish company only, so no other tenant can read your alerts.
- AutoPhish is hosted in Germany, processes data in the EU and offers a data processing agreement.
Google Workspace Integration FAQ
Does AutoPhish need a Gmail add-on to track reported phishing?
No. AutoPhish works with the "Report phishing" option that is built into Gmail. Google Workspace creates an alert for reported messages, and AutoPhish reads those alerts through the Alert Center API.
Which permissions does the integration need?
One domain-wide delegation scope for the Google Workspace Alert Center. AutoPhish uses it to list "User reported phishing" alerts and nothing else. It cannot read mailboxes, and it never modifies alerts.
How quickly do reports show up in AutoPhish?
AutoPhish checks for new alerts every few minutes. Google creates the alerts asynchronously, so a report can take up to a few hours to appear in your campaign results.
Do reported emails still reach Google?
Yes. AutoPhish only reads the alerts. Reports still go to Google, remain visible in your Alert Center and continue to improve Gmail's phishing filters.
Can AutoPhish sync users from the Google Workspace directory?
Not yet. Today you add Google Workspace users by CSV import or through the public API. Automatic directory sync is available for Microsoft 365, on-premises Active Directory and Nextcloud. Tell us if Google directory sync matters to you.
Is the Google Workspace integration included in my plan?
Yes. The integration is in beta and included in every AutoPhish plan at no extra cost. A company admin sets it up in the integration settings.
More AutoPhish Integrations
Microsoft 365
Sync Microsoft Entra ID groups into target lists every night, with nested groups and disabled accounts handled for you.
Learn moreActive Directory
Mirror on-premises AD groups with a signed PowerShell tool. AutoPhish never connects to your domain controller.
Learn moreNextcloud
Install the official app from the Nextcloud App Store and map Nextcloud groups to AutoPhish target lists.
Learn moreRun your first phishing test in 10 minutes.
Sign up free — no credit card. Try Pro free for 7 days when you're ready.